Log/copy all files that are created by a process

Discussion in 'Mac Programming' started by seson, Aug 22, 2010.

  1. seson macrumors newbie

    Joined:
    Nov 29, 2008
    #1
    Hi,

    I'm wondering how I could monitor a process and check for files that the process creates. I know lsof shows me all files that a process has opened and that are still open.

    Basically, I need something like lsof 1000 times a second. I'm wondering if this is the only solution, or if there's something better suited for this purpose (like dtrace or so)

    Thanks
    -Sebastian
     
  2. chown33 macrumors 604

    Joined:
    Aug 9, 2009
    #3
    Is this for a program you have the source for, or any arbitrary program?

    If you have source, what language?

    Have you looked at dtrace and found it lacking, or was your comment more like, "I know nothing about dtrace, but I could be persuaded to look into it if it seems worthwhile."?

    From the Wikipedia dtrace page:
    Code:
    # Files opened by process,
    dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'
    
    Found by googling: mac os dtrace
    http://www.mactech.com/articles/mactech/Vol.23/23.11/ExploringLeopardwithDTrace/index.html
    http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man1/dtrace.1.html

    Dtrace requires OS 10.5 or higher, and Developer Tools installed.


    There's also the fs_usage command, which seems tailor-made for this, given the pid option.
     

Share This Page